mesh-sdk/go/catalogue/several_secrets_test.go

package catalogue

import (
	"encoding/json"
	"testing"
)

// A module may need several values from one provider that gives one per pair (novox/hq
// 04-ISSUES/069, ADR 0094): `secrets` maps a requirement to several files under local names, and
// each local name is a pair credential of its own — its own need, its own file, its own holder.

const twoSecrets = `{"module":"ca","version":"1","requires":["secret"],
  "secrets":{"secret":{"root-key":"/var/lib/ca/root.key","root-pass":"/var/lib/ca/root.pass"}},
  "resources":[{"id":"state","type":"directory","path":"/var/lib/ca","mode":"0700"}]}`

func TestSecretsReadBothShapesAndWriteThemBack(t *testing.T) {
	m, err := decodeForTest([]byte(twoSecrets))
	if err != nil {
		t.Fatal(err)
	}
	files := m.SecretFiles("secret")
	if len(files) != 2 || files[0].Local != "root-key" || files[1].Path != "/var/lib/ca/root.pass" {
		t.Fatalf("two files under local names, in order: %+v", files)
	}
	plain, err := decodeForTest([]byte(`{"module":"app","version":"1","requires":["secret"],"secrets":{"secret":"/var/lib/app/secret"}}`))
	if err != nil {
		t.Fatal(err)
	}
	if got := plain.SecretFiles("secret"); len(got) != 1 || got[0].Local != "" || got[0].Path != "/var/lib/app/secret" {
		t.Fatalf("the plain shape is one file with no local name: %+v", got)
	}
	// Written back in the shape it was read, so a built manifest keeps its local names.
	raw, err := json.Marshal(m)
	if err != nil {
		t.Fatal(err)
	}
	again, err := decodeForTest(raw)
	if err != nil {
		t.Fatalf("what was written does not read: %v\n%s", err, raw)
	}
	if len(again.SecretFiles("secret")) != 2 {
		t.Fatalf("the local names did not survive a round trip:\n%s", raw)
	}
}